The difference is who controls the private keys. With a custodial wallet, a company such as a custodian or trading platform holds the keys and moves the coins for you. With a non-custodial (self-custody) wallet, you hold the keys yourself. Neither choice removes risk. It just changes what can go wrong. A custodian can be hacked, fail or go bankrupt. If you hold your own keys and lose them, or someone steals them, nobody can get the coins back for you. The SEC's Office of Investor Education and Assistance describes this same trade-off in its investor bulletin "Crypto Asset Custody Basics for Retail Investors" (Dec. 12, 2025).
What changed in 2026
Two regulatory moves this year affect where people keep their coins.
- EU, 1 July 2026. The transitional period under the Markets in Crypto-Assets Regulation (MiCA) ended. In a public statement dated 23 June 2026, ESMA told unauthorised crypto-asset service providers (CASPs) to stop onboarding new EU clients. It said custody of clients' crypto-assets "can only continue for the period strictly necessary to complete an orderly exit". ESMA also warned that clients of unauthorised CASPs "do not benefit from MiCA safeguards, including protections for client assets". It invited clients to check their provider in the ESMA Register and, where needed, move their assets to an authorised CASP "or to a self-hosted wallet".
- US, 1 October 2026. The SEC proposed a custody framework for crypto assets under the Investment Advisers Act of 1940 and the Investment Company Act of 1940. It covers registered investment advisers and regulated funds, not individual savers. Under the proposal, crypto assets could be "held in self-custody under certain circumstances", and state trust companies could act as custodians. It is a proposal, with a 60-day comment period that starts when it is published in the Federal Register.
What the private key actually controls
A wallet does not hold coins. The coins are recorded on the blockchain, and the wallet holds the keys that let you spend them. Whoever controls the key controls the coins. That is why "custodial or not" comes down to whose keys they are.
Most self-custody wallets show the key as a recovery phrase, defined by the Bitcoin standard BIP-39 (assigned 10 September 2013). A phrase has 12, 15, 18, 21 or 24 words, covering 128 to 256 bits of entropy. BIP-39 also allows an optional passphrase. The specification says "every passphrase generates a valid seed". So the same words plus a different passphrase open a different wallet, and a mistyped or forgotten passphrase does not show an error. It just opens an empty wallet.
Which custody risks apply to your coins?
Answer a few questions about where your coins are held to see which risks from this article apply to you.
Who holds the private key or recovery phrase for your coins?
- A company holds it, and I sign in with a password → next question
- I hold it myself as a recovery phrase → next question
Is your account plain custody, or a lending, earn or yield programme?
- Plain custody → next question
- Lending, earn or yield programme → The terms of use decide who owns the coins
- I am not sure → The terms of use decide who owns the coins
Are you an EU client, and is the provider an authorised CASP listed in the ESMA Register?
- EU client, and the provider is authorised → MiCA Article 75 protections apply
- EU client, but the provider is not authorised or I have not checked → MiCA safeguards do not cover you
- I am not an EU client → You rely on the custodian and local law
Is your recovery phrase written down and stored offline?
Did you add an optional BIP-39 passphrase to the recovery phrase?
- Yes, and the passphrase is backed up too → Your main risks are your own mistakes and theft
- Yes, but the passphrase is not backed up → A forgotten passphrase opens an empty wallet
- No passphrase → Your main risks are your own mistakes and theft
In the Celsius case, a judge ruled on 4 January 2023 that crypto in Earn accounts was presumptively property of the bankruptcy estate, because the terms of use transferred ownership to the company; customers became unsecured creditors. Read whether your product is plain custody or a lending or yield programme.
For authorised CASPs, client crypto-assets must be legally segregated from the provider's estate, the provider is liable for losses attributable to it (capped at market value at the time of loss), and assets must be returned as soon as possible. A hack, shutdown or bankruptcy can still disrupt access.
ESMA warned that clients of unauthorised CASPs do not benefit from MiCA safeguards, including protections for client assets. Since 1 July 2026 such providers may keep custody only for an orderly exit; ESMA invited clients to check the ESMA Register and, where needed, move assets to an authorised CASP or a self-hosted wallet.
The SEC bulletin warns that if a custodian is hacked, shuts down or goes bankrupt, you may lose access to your assets. It suggests checking the custodian's regulatory status, insurance, storage methods, whether it lends out or commingles customer assets, privacy practices and fees.
With self-custody, if your wallet is lost, stolen, damaged or hacked, you may permanently lose access. No help desk can reset a recovery phrase. The article's sources point to writing the phrase down, storing it offline and never typing it into a website.
Under BIP-39 every passphrase generates a valid seed, so the same words with a mistyped or forgotten passphrase open a different, empty wallet without any error. Without the passphrase, the phrase alone does not restore your coins.
A custodian's bankruptcy or freeze cannot lock your coins, but phishing, malware, lost backups and mistakes remain. Crypto payments typically cannot be reversed, so a transfer to a thief or a wrong address is generally gone. Hot wallets are more exposed to attacks; cold backups can be lost, damaged or stolen.
This sorts general custody risks from US and EU sources only; it does not assess a specific provider, wallet or jurisdiction elsewhere, and it is not investment advice.
Custodial wallets: what you rely on
A custodial account works like a login, not a key. If you lose your password, the provider can usually restore access, because it still holds the keys. That convenience comes with dependence on the company.
The custodian can fail. The SEC bulletin warns that if a third-party custodian is hacked, shuts down or goes bankrupt, you may lose access to your assets.
The terms of service decide who owns the coins. On 4 January 2023, Judge Martin Glenn of the US Bankruptcy Court for the Southern District of New York ruled that crypto in Celsius Network's "Earn" accounts was presumptively property of the bankruptcy estate. The reason was that Celsius's terms of use had transferred ownership of the deposits to the company. According to a Morrison Foerster summary of the ruling, Earn held about $4.2 billion in market value at the filing, 77% of platform assets. The customers became unsecured creditors. The ruling did not decide ownership for Celsius's separate Custody Program and other programs. In practice, "custody" and "earn" or "yield" products can treat your coins very differently, and the contract wording decides which treatment applies.
Regulation can help, if your provider is covered. For authorised CASPs, MiCA Article 75 requires client crypto-assets to be "legally segregated from the crypto-asset service provider's estate", so that the provider's creditors "have no recourse" to them. The same article makes the provider liable for lost assets or lost means of access "as a result of an incident that is attributable to them". That liability is capped at the asset's market value at the time of the loss. It also requires procedures to return client assets "as soon as possible". These protections apply only to MiCA-authorised providers serving EU clients.
Questions to ask a custodian
The SEC bulletin suggests checking a custodian's:
- background and regulatory status
- insurance
- storage methods
- whether it lends out or commingles customer assets
- privacy practices
- fees
In the EU, check the ESMA Register as well.
Non-custodial wallets: what you take on
With self-custody, the SEC bulletin says, "you control your crypto assets and are responsible for managing the private keys". It also warns: "If your crypto wallets are lost, stolen, damaged, or hacked, you may permanently lose access to your crypto assets." No help desk can reset a recovery phrase. The FTC adds that crypto payments typically cannot be reversed, so a transfer sent to a thief or to the wrong address is generally gone.
Self-custody does remove one specific risk: a custodian's bankruptcy or freeze cannot lock your coins. It replaces that risk with the risk of your own mistakes, lost backups, phishing and malware.
Hot and cold
The SEC bulletin notes that "hot and cold crypto wallet options exist for both self and third-party custody". Hot wallets stay online and are convenient, but they are more exposed to cyberattacks. Cold storage stays offline and is harder to hack, but a physical device or a paper backup can be lost, damaged or stolen.
Choosing between them
| Question | Custodial | Non-custodial |
|---|---|---|
| Who holds the private key | The provider | You |
| Lost password or device | Provider can usually restore access | Only your recovery phrase can |
| Provider hacked, frozen or bankrupt | Access may be disrupted or lost; outcome depends on terms and law | Not affected |
| Your own mistake, phishing or malware | Provider may be able to step in | No one can reverse it |
| Legal protection | Depends on jurisdiction and authorisation (e.g. MiCA Art. 75) | None beyond your own safeguards |
Some practical points that follow from the sources above:
- If you use a custodian, read whether a product is plain custody or a lending or yield programme. In the Celsius case, that wording decided who owned the coins. Check that the provider is authorised where you live.
- If you hold your own keys, write the recovery phrase down and store it offline. Never type it into a website or share it with anyone. If you use a BIP-39 passphrase, back it up too, because without it the phrase opens a different wallet. A separate explainer covers how to back up a wallet and where to keep the backup.
- Splitting is common. Because hot and cold options exist for both custody models, some people keep a small working balance online and the rest offline.
Limitations: this covers general custody mechanics and US and EU sources only. Rules elsewhere differ, and none of this is investment advice.
